You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@ratis.apache.org by "Tsz-wo Sze (Jira)" <ji...@apache.org> on 2026/08/15 21:19:00 UTC

[jira] [Updated] (RATIS-2659) IOUtils.readObject(..) should set ObjectInputFilter

     [ https://issues.apache.org/jira/browse/RATIS-2659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tsz-wo Sze updated RATIS-2659:
------------------------------
    Description: 
> Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?

According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils.readObject(..).

!image-2026-08-15-14-15-40-413.png|width=600!

  was:
> Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?

According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils. readObject(..).

!image-2026-08-15-14-15-40-413.png|width=600!

        Summary: IOUtils.readObject(..) should set ObjectInputFilter  (was: IOUtils. readObject(..) should set ObjectInputFilter)

> IOUtils.readObject(..) should set ObjectInputFilter
> ---------------------------------------------------
>
>                 Key: RATIS-2659
>                 URL: https://issues.apache.org/jira/browse/RATIS-2659
>             Project: Ratis
>          Issue Type: Improvement
>          Components: util
>            Reporter: Tsz-wo Sze
>            Assignee: Tsz-wo Sze
>            Priority: Major
>         Attachments: image-2026-08-15-14-15-40-413.png
>
>
> > Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?
> According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils.readObject(..).
> !image-2026-08-15-14-15-40-413.png|width=600!



--
This message was sent by Atlassian Jira
(v8.20.10#820010)